Skip to content
OpenAdvisories

Package · npm

actual

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 4.8
    CVE-2026-42890

    actual Allows Electron to Run As Node

    Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron 39.2.7), the ELECTRON_RUN_AS_NODE fuse is not disabled, allowing an attacker who can place a file on disk or control command-line arguments…

    actualbudget actual actual npm